1 //== BasicObjCFoundationChecks.cpp - Simple Apple-Foundation checks -*- C++ -*--
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file defines BasicObjCFoundationChecks, a class that encapsulates
11 // a set of simple checks to run on Objective-C code using Apple's Foundation
14 //===----------------------------------------------------------------------===//
16 #include "ClangSACheckers.h"
17 #include "SelectorExtras.h"
18 #include "clang/AST/ASTContext.h"
19 #include "clang/AST/DeclObjC.h"
20 #include "clang/AST/Expr.h"
21 #include "clang/AST/ExprObjC.h"
22 #include "clang/AST/StmtObjC.h"
23 #include "clang/Analysis/DomainSpecific/CocoaConventions.h"
24 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
25 #include "clang/StaticAnalyzer/Core/Checker.h"
26 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
27 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
28 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
29 #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"
30 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
31 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
32 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
33 #include "llvm/ADT/SmallString.h"
34 #include "llvm/ADT/StringMap.h"
35 #include "llvm/Support/raw_ostream.h"
37 using namespace clang;
41 class APIMisuse : public BugType {
43 APIMisuse(const CheckerBase *checker, const char *name)
44 : BugType(checker, name, "API Misuse (Apple)") {}
46 } // end anonymous namespace
48 //===----------------------------------------------------------------------===//
50 //===----------------------------------------------------------------------===//
52 static StringRef GetReceiverInterfaceName(const ObjCMethodCall &msg) {
53 if (const ObjCInterfaceDecl *ID = msg.getReceiverInterface())
54 return ID->getIdentifier()->getName();
58 enum FoundationClass {
69 static FoundationClass findKnownClass(const ObjCInterfaceDecl *ID,
70 bool IncludeSuperclasses = true) {
71 static llvm::StringMap<FoundationClass> Classes;
72 if (Classes.empty()) {
73 Classes["NSArray"] = FC_NSArray;
74 Classes["NSDictionary"] = FC_NSDictionary;
75 Classes["NSEnumerator"] = FC_NSEnumerator;
76 Classes["NSNull"] = FC_NSNull;
77 Classes["NSOrderedSet"] = FC_NSOrderedSet;
78 Classes["NSSet"] = FC_NSSet;
79 Classes["NSString"] = FC_NSString;
82 // FIXME: Should we cache this at all?
83 FoundationClass result = Classes.lookup(ID->getIdentifier()->getName());
84 if (result == FC_None && IncludeSuperclasses)
85 if (const ObjCInterfaceDecl *Super = ID->getSuperClass())
86 return findKnownClass(Super);
91 //===----------------------------------------------------------------------===//
92 // NilArgChecker - Check for prohibited nil arguments to ObjC method calls.
93 //===----------------------------------------------------------------------===//
96 class NilArgChecker : public Checker<check::PreObjCMessage,
97 check::PostStmt<ObjCDictionaryLiteral>,
98 check::PostStmt<ObjCArrayLiteral> > {
99 mutable std::unique_ptr<APIMisuse> BT;
101 mutable llvm::SmallDenseMap<Selector, unsigned, 16> StringSelectors;
102 mutable Selector ArrayWithObjectSel;
103 mutable Selector AddObjectSel;
104 mutable Selector InsertObjectAtIndexSel;
105 mutable Selector ReplaceObjectAtIndexWithObjectSel;
106 mutable Selector SetObjectAtIndexedSubscriptSel;
107 mutable Selector ArrayByAddingObjectSel;
108 mutable Selector DictionaryWithObjectForKeySel;
109 mutable Selector SetObjectForKeySel;
110 mutable Selector SetObjectForKeyedSubscriptSel;
111 mutable Selector RemoveObjectForKeySel;
113 void warnIfNilExpr(const Expr *E,
115 CheckerContext &C) const;
117 void warnIfNilArg(CheckerContext &C,
118 const ObjCMethodCall &msg, unsigned Arg,
119 FoundationClass Class,
120 bool CanBeSubscript = false) const;
122 void generateBugReport(ExplodedNode *N,
126 CheckerContext &C) const;
129 void checkPreObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
130 void checkPostStmt(const ObjCDictionaryLiteral *DL,
131 CheckerContext &C) const;
132 void checkPostStmt(const ObjCArrayLiteral *AL,
133 CheckerContext &C) const;
137 void NilArgChecker::warnIfNilExpr(const Expr *E,
139 CheckerContext &C) const {
140 ProgramStateRef State = C.getState();
141 if (State->isNull(C.getSVal(E)).isConstrainedTrue()) {
143 if (ExplodedNode *N = C.generateErrorNode()) {
144 generateBugReport(N, Msg, E->getSourceRange(), E, C);
150 void NilArgChecker::warnIfNilArg(CheckerContext &C,
151 const ObjCMethodCall &msg,
153 FoundationClass Class,
154 bool CanBeSubscript) const {
155 // Check if the argument is nil.
156 ProgramStateRef State = C.getState();
157 if (!State->isNull(msg.getArgSVal(Arg)).isConstrainedTrue())
160 if (ExplodedNode *N = C.generateErrorNode()) {
161 SmallString<128> sbuf;
162 llvm::raw_svector_ostream os(sbuf);
164 if (CanBeSubscript && msg.getMessageKind() == OCM_Subscript) {
166 if (Class == FC_NSArray) {
167 os << "Array element cannot be nil";
168 } else if (Class == FC_NSDictionary) {
170 os << "Value stored into '";
171 os << GetReceiverInterfaceName(msg) << "' cannot be nil";
174 os << "'"<< GetReceiverInterfaceName(msg) << "' key cannot be nil";
177 llvm_unreachable("Missing foundation class for the subscript expr");
180 if (Class == FC_NSDictionary) {
182 os << "Value argument ";
185 os << "Key argument ";
188 msg.getSelector().print(os);
189 os << "' cannot be nil";
191 os << "Argument to '" << GetReceiverInterfaceName(msg) << "' method '";
192 msg.getSelector().print(os);
193 os << "' cannot be nil";
197 generateBugReport(N, os.str(), msg.getArgSourceRange(Arg),
198 msg.getArgExpr(Arg), C);
202 void NilArgChecker::generateBugReport(ExplodedNode *N,
206 CheckerContext &C) const {
208 BT.reset(new APIMisuse(this, "nil argument"));
210 auto R = llvm::make_unique<BugReport>(*BT, Msg, N);
212 bugreporter::trackNullOrUndefValue(N, E, *R);
213 C.emitReport(std::move(R));
216 void NilArgChecker::checkPreObjCMessage(const ObjCMethodCall &msg,
217 CheckerContext &C) const {
218 const ObjCInterfaceDecl *ID = msg.getReceiverInterface();
222 FoundationClass Class = findKnownClass(ID);
224 static const unsigned InvalidArgIndex = UINT_MAX;
225 unsigned Arg = InvalidArgIndex;
226 bool CanBeSubscript = false;
228 if (Class == FC_NSString) {
229 Selector S = msg.getSelector();
231 if (S.isUnarySelector())
234 if (StringSelectors.empty()) {
235 ASTContext &Ctx = C.getASTContext();
237 getKeywordSelector(Ctx, "caseInsensitiveCompare", nullptr),
238 getKeywordSelector(Ctx, "compare", nullptr),
239 getKeywordSelector(Ctx, "compare", "options", nullptr),
240 getKeywordSelector(Ctx, "compare", "options", "range", nullptr),
241 getKeywordSelector(Ctx, "compare", "options", "range", "locale",
243 getKeywordSelector(Ctx, "componentsSeparatedByCharactersInSet",
245 getKeywordSelector(Ctx, "initWithFormat",
247 getKeywordSelector(Ctx, "localizedCaseInsensitiveCompare", nullptr),
248 getKeywordSelector(Ctx, "localizedCompare", nullptr),
249 getKeywordSelector(Ctx, "localizedStandardCompare", nullptr),
251 for (Selector KnownSel : Sels)
252 StringSelectors[KnownSel] = 0;
254 auto I = StringSelectors.find(S);
255 if (I == StringSelectors.end())
258 } else if (Class == FC_NSArray) {
259 Selector S = msg.getSelector();
261 if (S.isUnarySelector())
264 if (ArrayWithObjectSel.isNull()) {
265 ASTContext &Ctx = C.getASTContext();
266 ArrayWithObjectSel = getKeywordSelector(Ctx, "arrayWithObject", nullptr);
267 AddObjectSel = getKeywordSelector(Ctx, "addObject", nullptr);
268 InsertObjectAtIndexSel =
269 getKeywordSelector(Ctx, "insertObject", "atIndex", nullptr);
270 ReplaceObjectAtIndexWithObjectSel =
271 getKeywordSelector(Ctx, "replaceObjectAtIndex", "withObject", nullptr);
272 SetObjectAtIndexedSubscriptSel =
273 getKeywordSelector(Ctx, "setObject", "atIndexedSubscript", nullptr);
274 ArrayByAddingObjectSel =
275 getKeywordSelector(Ctx, "arrayByAddingObject", nullptr);
278 if (S == ArrayWithObjectSel || S == AddObjectSel ||
279 S == InsertObjectAtIndexSel || S == ArrayByAddingObjectSel) {
281 } else if (S == SetObjectAtIndexedSubscriptSel) {
283 CanBeSubscript = true;
284 } else if (S == ReplaceObjectAtIndexWithObjectSel) {
287 } else if (Class == FC_NSDictionary) {
288 Selector S = msg.getSelector();
290 if (S.isUnarySelector())
293 if (DictionaryWithObjectForKeySel.isNull()) {
294 ASTContext &Ctx = C.getASTContext();
295 DictionaryWithObjectForKeySel =
296 getKeywordSelector(Ctx, "dictionaryWithObject", "forKey", nullptr);
298 getKeywordSelector(Ctx, "setObject", "forKey", nullptr);
299 SetObjectForKeyedSubscriptSel =
300 getKeywordSelector(Ctx, "setObject", "forKeyedSubscript", nullptr);
301 RemoveObjectForKeySel =
302 getKeywordSelector(Ctx, "removeObjectForKey", nullptr);
305 if (S == DictionaryWithObjectForKeySel || S == SetObjectForKeySel) {
307 warnIfNilArg(C, msg, /* Arg */1, Class);
308 } else if (S == SetObjectForKeyedSubscriptSel) {
309 CanBeSubscript = true;
311 } else if (S == RemoveObjectForKeySel) {
316 // If argument is '0', report a warning.
317 if ((Arg != InvalidArgIndex))
318 warnIfNilArg(C, msg, Arg, Class, CanBeSubscript);
321 void NilArgChecker::checkPostStmt(const ObjCArrayLiteral *AL,
322 CheckerContext &C) const {
323 unsigned NumOfElements = AL->getNumElements();
324 for (unsigned i = 0; i < NumOfElements; ++i) {
325 warnIfNilExpr(AL->getElement(i), "Array element cannot be nil", C);
329 void NilArgChecker::checkPostStmt(const ObjCDictionaryLiteral *DL,
330 CheckerContext &C) const {
331 unsigned NumOfElements = DL->getNumElements();
332 for (unsigned i = 0; i < NumOfElements; ++i) {
333 ObjCDictionaryElement Element = DL->getKeyValueElement(i);
334 warnIfNilExpr(Element.Key, "Dictionary key cannot be nil", C);
335 warnIfNilExpr(Element.Value, "Dictionary value cannot be nil", C);
339 //===----------------------------------------------------------------------===//
341 //===----------------------------------------------------------------------===//
344 class CFNumberCreateChecker : public Checker< check::PreStmt<CallExpr> > {
345 mutable std::unique_ptr<APIMisuse> BT;
346 mutable IdentifierInfo* II;
348 CFNumberCreateChecker() : II(nullptr) {}
350 void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
353 void EmitError(const TypedRegion* R, const Expr *Ex,
354 uint64_t SourceSize, uint64_t TargetSize, uint64_t NumberKind);
356 } // end anonymous namespace
359 kCFNumberSInt8Type = 1,
360 kCFNumberSInt16Type = 2,
361 kCFNumberSInt32Type = 3,
362 kCFNumberSInt64Type = 4,
363 kCFNumberFloat32Type = 5,
364 kCFNumberFloat64Type = 6,
365 kCFNumberCharType = 7,
366 kCFNumberShortType = 8,
367 kCFNumberIntType = 9,
368 kCFNumberLongType = 10,
369 kCFNumberLongLongType = 11,
370 kCFNumberFloatType = 12,
371 kCFNumberDoubleType = 13,
372 kCFNumberCFIndexType = 14,
373 kCFNumberNSIntegerType = 15,
374 kCFNumberCGFloatType = 16
377 static Optional<uint64_t> GetCFNumberSize(ASTContext &Ctx, uint64_t i) {
378 static const unsigned char FixedSize[] = { 8, 16, 32, 64, 32, 64 };
380 if (i < kCFNumberCharType)
381 return FixedSize[i-1];
386 case kCFNumberCharType: T = Ctx.CharTy; break;
387 case kCFNumberShortType: T = Ctx.ShortTy; break;
388 case kCFNumberIntType: T = Ctx.IntTy; break;
389 case kCFNumberLongType: T = Ctx.LongTy; break;
390 case kCFNumberLongLongType: T = Ctx.LongLongTy; break;
391 case kCFNumberFloatType: T = Ctx.FloatTy; break;
392 case kCFNumberDoubleType: T = Ctx.DoubleTy; break;
393 case kCFNumberCFIndexType:
394 case kCFNumberNSIntegerType:
395 case kCFNumberCGFloatType:
396 // FIXME: We need a way to map from names to Type*.
401 return Ctx.getTypeSize(T);
405 static const char* GetCFNumberTypeStr(uint64_t i) {
406 static const char* Names[] = {
407 "kCFNumberSInt8Type",
408 "kCFNumberSInt16Type",
409 "kCFNumberSInt32Type",
410 "kCFNumberSInt64Type",
411 "kCFNumberFloat32Type",
412 "kCFNumberFloat64Type",
414 "kCFNumberShortType",
417 "kCFNumberLongLongType",
418 "kCFNumberFloatType",
419 "kCFNumberDoubleType",
420 "kCFNumberCFIndexType",
421 "kCFNumberNSIntegerType",
422 "kCFNumberCGFloatType"
425 return i <= kCFNumberCGFloatType ? Names[i-1] : "Invalid CFNumberType";
429 void CFNumberCreateChecker::checkPreStmt(const CallExpr *CE,
430 CheckerContext &C) const {
431 ProgramStateRef state = C.getState();
432 const FunctionDecl *FD = C.getCalleeDecl(CE);
436 ASTContext &Ctx = C.getASTContext();
438 II = &Ctx.Idents.get("CFNumberCreate");
440 if (FD->getIdentifier() != II || CE->getNumArgs() != 3)
443 // Get the value of the "theType" argument.
444 const LocationContext *LCtx = C.getLocationContext();
445 SVal TheTypeVal = state->getSVal(CE->getArg(1), LCtx);
447 // FIXME: We really should allow ranges of valid theType values, and
448 // bifurcate the state appropriately.
449 Optional<nonloc::ConcreteInt> V = TheTypeVal.getAs<nonloc::ConcreteInt>();
453 uint64_t NumberKind = V->getValue().getLimitedValue();
454 Optional<uint64_t> OptTargetSize = GetCFNumberSize(Ctx, NumberKind);
456 // FIXME: In some cases we can emit an error.
460 uint64_t TargetSize = *OptTargetSize;
462 // Look at the value of the integer being passed by reference. Essentially
463 // we want to catch cases where the value passed in is not equal to the
464 // size of the type being created.
465 SVal TheValueExpr = state->getSVal(CE->getArg(2), LCtx);
467 // FIXME: Eventually we should handle arbitrary locations. We can do this
468 // by having an enhanced memory model that does low-level typing.
469 Optional<loc::MemRegionVal> LV = TheValueExpr.getAs<loc::MemRegionVal>();
473 const TypedValueRegion* R = dyn_cast<TypedValueRegion>(LV->stripCasts());
477 QualType T = Ctx.getCanonicalType(R->getValueType());
479 // FIXME: If the pointee isn't an integer type, should we flag a warning?
480 // People can do weird stuff with pointers.
482 if (!T->isIntegralOrEnumerationType())
485 uint64_t SourceSize = Ctx.getTypeSize(T);
487 // CHECK: is SourceSize == TargetSize
488 if (SourceSize == TargetSize)
491 // Generate an error. Only generate a sink error node
492 // if 'SourceSize < TargetSize'; otherwise generate a non-fatal error node.
494 // FIXME: We can actually create an abstract "CFNumber" object that has
495 // the bits initialized to the provided values.
497 ExplodedNode *N = SourceSize < TargetSize ? C.generateErrorNode()
498 : C.generateNonFatalErrorNode();
500 SmallString<128> sbuf;
501 llvm::raw_svector_ostream os(sbuf);
503 os << (SourceSize == 8 ? "An " : "A ")
504 << SourceSize << " bit integer is used to initialize a CFNumber "
505 "object that represents "
506 << (TargetSize == 8 ? "an " : "a ")
507 << TargetSize << " bit integer. ";
509 if (SourceSize < TargetSize)
510 os << (TargetSize - SourceSize)
511 << " bits of the CFNumber value will be garbage." ;
513 os << (SourceSize - TargetSize)
514 << " bits of the input integer will be lost.";
517 BT.reset(new APIMisuse(this, "Bad use of CFNumberCreate"));
519 auto report = llvm::make_unique<BugReport>(*BT, os.str(), N);
520 report->addRange(CE->getArg(2)->getSourceRange());
521 C.emitReport(std::move(report));
525 //===----------------------------------------------------------------------===//
526 // CFRetain/CFRelease/CFMakeCollectable/CFAutorelease checking for null arguments.
527 //===----------------------------------------------------------------------===//
530 class CFRetainReleaseChecker : public Checker< check::PreStmt<CallExpr> > {
531 mutable std::unique_ptr<APIMisuse> BT;
532 mutable IdentifierInfo *Retain, *Release, *MakeCollectable, *Autorelease;
534 CFRetainReleaseChecker()
535 : Retain(nullptr), Release(nullptr), MakeCollectable(nullptr),
536 Autorelease(nullptr) {}
537 void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
539 } // end anonymous namespace
542 void CFRetainReleaseChecker::checkPreStmt(const CallExpr *CE,
543 CheckerContext &C) const {
544 // If the CallExpr doesn't have exactly 1 argument just give up checking.
545 if (CE->getNumArgs() != 1)
548 ProgramStateRef state = C.getState();
549 const FunctionDecl *FD = C.getCalleeDecl(CE);
554 ASTContext &Ctx = C.getASTContext();
555 Retain = &Ctx.Idents.get("CFRetain");
556 Release = &Ctx.Idents.get("CFRelease");
557 MakeCollectable = &Ctx.Idents.get("CFMakeCollectable");
558 Autorelease = &Ctx.Idents.get("CFAutorelease");
559 BT.reset(new APIMisuse(
560 this, "null passed to CF memory management function"));
563 // Check if we called CFRetain/CFRelease/CFMakeCollectable/CFAutorelease.
564 const IdentifierInfo *FuncII = FD->getIdentifier();
565 if (!(FuncII == Retain || FuncII == Release || FuncII == MakeCollectable ||
566 FuncII == Autorelease))
569 // FIXME: The rest of this just checks that the argument is non-null.
570 // It should probably be refactored and combined with NonNullParamChecker.
572 // Get the argument's value.
573 const Expr *Arg = CE->getArg(0);
574 SVal ArgVal = state->getSVal(Arg, C.getLocationContext());
575 Optional<DefinedSVal> DefArgVal = ArgVal.getAs<DefinedSVal>();
580 SValBuilder &svalBuilder = C.getSValBuilder();
582 svalBuilder.makeZeroVal(Arg->getType()).castAs<DefinedSVal>();
584 // Make an expression asserting that they're equal.
585 DefinedOrUnknownSVal ArgIsNull = svalBuilder.evalEQ(state, zero, *DefArgVal);
588 ProgramStateRef stateTrue, stateFalse;
589 std::tie(stateTrue, stateFalse) = state->assume(ArgIsNull);
591 if (stateTrue && !stateFalse) {
592 ExplodedNode *N = C.generateErrorNode(stateTrue);
596 const char *description;
597 if (FuncII == Retain)
598 description = "Null pointer argument in call to CFRetain";
599 else if (FuncII == Release)
600 description = "Null pointer argument in call to CFRelease";
601 else if (FuncII == MakeCollectable)
602 description = "Null pointer argument in call to CFMakeCollectable";
603 else if (FuncII == Autorelease)
604 description = "Null pointer argument in call to CFAutorelease";
606 llvm_unreachable("impossible case");
608 auto report = llvm::make_unique<BugReport>(*BT, description, N);
609 report->addRange(Arg->getSourceRange());
610 bugreporter::trackNullOrUndefValue(N, Arg, *report);
611 C.emitReport(std::move(report));
615 // From here on, we know the argument is non-null.
616 C.addTransition(stateFalse);
619 //===----------------------------------------------------------------------===//
620 // Check for sending 'retain', 'release', or 'autorelease' directly to a Class.
621 //===----------------------------------------------------------------------===//
624 class ClassReleaseChecker : public Checker<check::PreObjCMessage> {
625 mutable Selector releaseS;
626 mutable Selector retainS;
627 mutable Selector autoreleaseS;
628 mutable Selector drainS;
629 mutable std::unique_ptr<BugType> BT;
632 void checkPreObjCMessage(const ObjCMethodCall &msg, CheckerContext &C) const;
636 void ClassReleaseChecker::checkPreObjCMessage(const ObjCMethodCall &msg,
637 CheckerContext &C) const {
640 BT.reset(new APIMisuse(
641 this, "message incorrectly sent to class instead of class instance"));
643 ASTContext &Ctx = C.getASTContext();
644 releaseS = GetNullarySelector("release", Ctx);
645 retainS = GetNullarySelector("retain", Ctx);
646 autoreleaseS = GetNullarySelector("autorelease", Ctx);
647 drainS = GetNullarySelector("drain", Ctx);
650 if (msg.isInstanceMessage())
652 const ObjCInterfaceDecl *Class = msg.getReceiverInterface();
655 Selector S = msg.getSelector();
656 if (!(S == releaseS || S == retainS || S == autoreleaseS || S == drainS))
659 if (ExplodedNode *N = C.generateNonFatalErrorNode()) {
660 SmallString<200> buf;
661 llvm::raw_svector_ostream os(buf);
665 os << "' message should be sent to instances "
666 "of class '" << Class->getName()
667 << "' and not the class directly";
669 auto report = llvm::make_unique<BugReport>(*BT, os.str(), N);
670 report->addRange(msg.getSourceRange());
671 C.emitReport(std::move(report));
675 //===----------------------------------------------------------------------===//
676 // Check for passing non-Objective-C types to variadic methods that expect
677 // only Objective-C types.
678 //===----------------------------------------------------------------------===//
681 class VariadicMethodTypeChecker : public Checker<check::PreObjCMessage> {
682 mutable Selector arrayWithObjectsS;
683 mutable Selector dictionaryWithObjectsAndKeysS;
684 mutable Selector setWithObjectsS;
685 mutable Selector orderedSetWithObjectsS;
686 mutable Selector initWithObjectsS;
687 mutable Selector initWithObjectsAndKeysS;
688 mutable std::unique_ptr<BugType> BT;
690 bool isVariadicMessage(const ObjCMethodCall &msg) const;
693 void checkPreObjCMessage(const ObjCMethodCall &msg, CheckerContext &C) const;
697 /// isVariadicMessage - Returns whether the given message is a variadic message,
698 /// where all arguments must be Objective-C types.
700 VariadicMethodTypeChecker::isVariadicMessage(const ObjCMethodCall &msg) const {
701 const ObjCMethodDecl *MD = msg.getDecl();
703 if (!MD || !MD->isVariadic() || isa<ObjCProtocolDecl>(MD->getDeclContext()))
706 Selector S = msg.getSelector();
708 if (msg.isInstanceMessage()) {
709 // FIXME: Ideally we'd look at the receiver interface here, but that's not
710 // useful for init, because alloc returns 'id'. In theory, this could lead
711 // to false positives, for example if there existed a class that had an
712 // initWithObjects: implementation that does accept non-Objective-C pointer
713 // types, but the chance of that happening is pretty small compared to the
714 // gains that this analysis gives.
715 const ObjCInterfaceDecl *Class = MD->getClassInterface();
717 switch (findKnownClass(Class)) {
719 case FC_NSOrderedSet:
721 return S == initWithObjectsS;
722 case FC_NSDictionary:
723 return S == initWithObjectsAndKeysS;
728 const ObjCInterfaceDecl *Class = msg.getReceiverInterface();
730 switch (findKnownClass(Class)) {
732 return S == arrayWithObjectsS;
733 case FC_NSOrderedSet:
734 return S == orderedSetWithObjectsS;
736 return S == setWithObjectsS;
737 case FC_NSDictionary:
738 return S == dictionaryWithObjectsAndKeysS;
745 void VariadicMethodTypeChecker::checkPreObjCMessage(const ObjCMethodCall &msg,
746 CheckerContext &C) const {
748 BT.reset(new APIMisuse(this,
749 "Arguments passed to variadic method aren't all "
750 "Objective-C pointer types"));
752 ASTContext &Ctx = C.getASTContext();
753 arrayWithObjectsS = GetUnarySelector("arrayWithObjects", Ctx);
754 dictionaryWithObjectsAndKeysS =
755 GetUnarySelector("dictionaryWithObjectsAndKeys", Ctx);
756 setWithObjectsS = GetUnarySelector("setWithObjects", Ctx);
757 orderedSetWithObjectsS = GetUnarySelector("orderedSetWithObjects", Ctx);
759 initWithObjectsS = GetUnarySelector("initWithObjects", Ctx);
760 initWithObjectsAndKeysS = GetUnarySelector("initWithObjectsAndKeys", Ctx);
763 if (!isVariadicMessage(msg))
766 // We are not interested in the selector arguments since they have
767 // well-defined types, so the compiler will issue a warning for them.
768 unsigned variadicArgsBegin = msg.getSelector().getNumArgs();
770 // We're not interested in the last argument since it has to be nil or the
771 // compiler would have issued a warning for it elsewhere.
772 unsigned variadicArgsEnd = msg.getNumArgs() - 1;
774 if (variadicArgsEnd <= variadicArgsBegin)
777 // Verify that all arguments have Objective-C types.
778 Optional<ExplodedNode*> errorNode;
780 for (unsigned I = variadicArgsBegin; I != variadicArgsEnd; ++I) {
781 QualType ArgTy = msg.getArgExpr(I)->getType();
782 if (ArgTy->isObjCObjectPointerType())
785 // Block pointers are treaded as Objective-C pointers.
786 if (ArgTy->isBlockPointerType())
789 // Ignore pointer constants.
790 if (msg.getArgSVal(I).getAs<loc::ConcreteInt>())
793 // Ignore pointer types annotated with 'NSObject' attribute.
794 if (C.getASTContext().isObjCNSObjectType(ArgTy))
797 // Ignore CF references, which can be toll-free bridged.
798 if (coreFoundation::isCFObjectRef(ArgTy))
801 // Generate only one error node to use for all bug reports.
802 if (!errorNode.hasValue())
803 errorNode = C.generateNonFatalErrorNode();
805 if (!errorNode.getValue())
808 SmallString<128> sbuf;
809 llvm::raw_svector_ostream os(sbuf);
811 StringRef TypeName = GetReceiverInterfaceName(msg);
812 if (!TypeName.empty())
813 os << "Argument to '" << TypeName << "' method '";
815 os << "Argument to method '";
817 msg.getSelector().print(os);
818 os << "' should be an Objective-C pointer type, not '";
819 ArgTy.print(os, C.getLangOpts());
822 auto R = llvm::make_unique<BugReport>(*BT, os.str(), errorNode.getValue());
823 R->addRange(msg.getArgSourceRange(I));
824 C.emitReport(std::move(R));
828 //===----------------------------------------------------------------------===//
829 // Improves the modeling of loops over Cocoa collections.
830 //===----------------------------------------------------------------------===//
832 // The map from container symbol to the container count symbol.
833 // We currently will remember the last countainer count symbol encountered.
834 REGISTER_MAP_WITH_PROGRAMSTATE(ContainerCountMap, SymbolRef, SymbolRef)
835 REGISTER_MAP_WITH_PROGRAMSTATE(ContainerNonEmptyMap, SymbolRef, bool)
838 class ObjCLoopChecker
839 : public Checker<check::PostStmt<ObjCForCollectionStmt>,
840 check::PostObjCMessage,
842 check::PointerEscape > {
843 mutable IdentifierInfo *CountSelectorII;
845 bool isCollectionCountMethod(const ObjCMethodCall &M,
846 CheckerContext &C) const;
849 ObjCLoopChecker() : CountSelectorII(nullptr) {}
850 void checkPostStmt(const ObjCForCollectionStmt *FCS, CheckerContext &C) const;
851 void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
852 void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
853 ProgramStateRef checkPointerEscape(ProgramStateRef State,
854 const InvalidatedSymbols &Escaped,
855 const CallEvent *Call,
856 PointerEscapeKind Kind) const;
860 static bool isKnownNonNilCollectionType(QualType T) {
861 const ObjCObjectPointerType *PT = T->getAs<ObjCObjectPointerType>();
865 const ObjCInterfaceDecl *ID = PT->getInterfaceDecl();
869 switch (findKnownClass(ID)) {
871 case FC_NSDictionary:
872 case FC_NSEnumerator:
873 case FC_NSOrderedSet:
881 /// Assumes that the collection is non-nil.
883 /// If the collection is known to be nil, returns NULL to indicate an infeasible
885 static ProgramStateRef checkCollectionNonNil(CheckerContext &C,
886 ProgramStateRef State,
887 const ObjCForCollectionStmt *FCS) {
891 SVal CollectionVal = C.getSVal(FCS->getCollection());
892 Optional<DefinedSVal> KnownCollection = CollectionVal.getAs<DefinedSVal>();
893 if (!KnownCollection)
896 ProgramStateRef StNonNil, StNil;
897 std::tie(StNonNil, StNil) = State->assume(*KnownCollection);
898 if (StNil && !StNonNil) {
899 // The collection is nil. This path is infeasible.
906 /// Assumes that the collection elements are non-nil.
908 /// This only applies if the collection is one of those known not to contain
910 static ProgramStateRef checkElementNonNil(CheckerContext &C,
911 ProgramStateRef State,
912 const ObjCForCollectionStmt *FCS) {
916 // See if the collection is one where we /know/ the elements are non-nil.
917 if (!isKnownNonNilCollectionType(FCS->getCollection()->getType()))
920 const LocationContext *LCtx = C.getLocationContext();
921 const Stmt *Element = FCS->getElement();
923 // FIXME: Copied from ExprEngineObjC.
924 Optional<Loc> ElementLoc;
925 if (const DeclStmt *DS = dyn_cast<DeclStmt>(Element)) {
926 const VarDecl *ElemDecl = cast<VarDecl>(DS->getSingleDecl());
927 assert(ElemDecl->getInit() == nullptr);
928 ElementLoc = State->getLValue(ElemDecl, LCtx);
930 ElementLoc = State->getSVal(Element, LCtx).getAs<Loc>();
936 // Go ahead and assume the value is non-nil.
937 SVal Val = State->getSVal(*ElementLoc);
938 return State->assume(Val.castAs<DefinedOrUnknownSVal>(), true);
941 /// Returns NULL state if the collection is known to contain elements
942 /// (or is known not to contain elements if the Assumption parameter is false.)
943 static ProgramStateRef
944 assumeCollectionNonEmpty(CheckerContext &C, ProgramStateRef State,
945 SymbolRef CollectionS, bool Assumption) {
946 if (!State || !CollectionS)
949 const SymbolRef *CountS = State->get<ContainerCountMap>(CollectionS);
951 const bool *KnownNonEmpty = State->get<ContainerNonEmptyMap>(CollectionS);
953 return State->set<ContainerNonEmptyMap>(CollectionS, Assumption);
954 return (Assumption == *KnownNonEmpty) ? State : nullptr;
957 SValBuilder &SvalBuilder = C.getSValBuilder();
958 SVal CountGreaterThanZeroVal =
959 SvalBuilder.evalBinOp(State, BO_GT,
960 nonloc::SymbolVal(*CountS),
961 SvalBuilder.makeIntVal(0, (*CountS)->getType()),
962 SvalBuilder.getConditionType());
963 Optional<DefinedSVal> CountGreaterThanZero =
964 CountGreaterThanZeroVal.getAs<DefinedSVal>();
965 if (!CountGreaterThanZero) {
966 // The SValBuilder cannot construct a valid SVal for this condition.
967 // This means we cannot properly reason about it.
971 return State->assume(*CountGreaterThanZero, Assumption);
974 static ProgramStateRef
975 assumeCollectionNonEmpty(CheckerContext &C, ProgramStateRef State,
976 const ObjCForCollectionStmt *FCS,
981 SymbolRef CollectionS =
982 State->getSVal(FCS->getCollection(), C.getLocationContext()).getAsSymbol();
983 return assumeCollectionNonEmpty(C, State, CollectionS, Assumption);
987 /// If the fist block edge is a back edge, we are reentering the loop.
988 static bool alreadyExecutedAtLeastOneLoopIteration(const ExplodedNode *N,
989 const ObjCForCollectionStmt *FCS) {
993 ProgramPoint P = N->getLocation();
994 if (Optional<BlockEdge> BE = P.getAs<BlockEdge>()) {
995 return BE->getSrc()->getLoopTarget() == FCS;
998 // Keep looking for a block edge.
999 for (ExplodedNode::const_pred_iterator I = N->pred_begin(),
1000 E = N->pred_end(); I != E; ++I) {
1001 if (alreadyExecutedAtLeastOneLoopIteration(*I, FCS))
1008 void ObjCLoopChecker::checkPostStmt(const ObjCForCollectionStmt *FCS,
1009 CheckerContext &C) const {
1010 ProgramStateRef State = C.getState();
1012 // Check if this is the branch for the end of the loop.
1013 SVal CollectionSentinel = C.getSVal(FCS);
1014 if (CollectionSentinel.isZeroConstant()) {
1015 if (!alreadyExecutedAtLeastOneLoopIteration(C.getPredecessor(), FCS))
1016 State = assumeCollectionNonEmpty(C, State, FCS, /*Assumption*/false);
1018 // Otherwise, this is a branch that goes through the loop body.
1020 State = checkCollectionNonNil(C, State, FCS);
1021 State = checkElementNonNil(C, State, FCS);
1022 State = assumeCollectionNonEmpty(C, State, FCS, /*Assumption*/true);
1026 C.generateSink(C.getState(), C.getPredecessor());
1027 else if (State != C.getState())
1028 C.addTransition(State);
1031 bool ObjCLoopChecker::isCollectionCountMethod(const ObjCMethodCall &M,
1032 CheckerContext &C) const {
1033 Selector S = M.getSelector();
1034 // Initialize the identifiers on first use.
1035 if (!CountSelectorII)
1036 CountSelectorII = &C.getASTContext().Idents.get("count");
1038 // If the method returns collection count, record the value.
1039 return S.isUnarySelector() &&
1040 (S.getIdentifierInfoForSlot(0) == CountSelectorII);
1043 void ObjCLoopChecker::checkPostObjCMessage(const ObjCMethodCall &M,
1044 CheckerContext &C) const {
1045 if (!M.isInstanceMessage())
1048 const ObjCInterfaceDecl *ClassID = M.getReceiverInterface();
1052 FoundationClass Class = findKnownClass(ClassID);
1053 if (Class != FC_NSDictionary &&
1054 Class != FC_NSArray &&
1055 Class != FC_NSSet &&
1056 Class != FC_NSOrderedSet)
1059 SymbolRef ContainerS = M.getReceiverSVal().getAsSymbol();
1063 // If we are processing a call to "count", get the symbolic value returned by
1064 // a call to "count" and add it to the map.
1065 if (!isCollectionCountMethod(M, C))
1068 const Expr *MsgExpr = M.getOriginExpr();
1069 SymbolRef CountS = C.getSVal(MsgExpr).getAsSymbol();
1071 ProgramStateRef State = C.getState();
1073 C.getSymbolManager().addSymbolDependency(ContainerS, CountS);
1074 State = State->set<ContainerCountMap>(ContainerS, CountS);
1076 if (const bool *NonEmpty = State->get<ContainerNonEmptyMap>(ContainerS)) {
1077 State = State->remove<ContainerNonEmptyMap>(ContainerS);
1078 State = assumeCollectionNonEmpty(C, State, ContainerS, *NonEmpty);
1081 C.addTransition(State);
1086 static SymbolRef getMethodReceiverIfKnownImmutable(const CallEvent *Call) {
1087 const ObjCMethodCall *Message = dyn_cast_or_null<ObjCMethodCall>(Call);
1091 const ObjCMethodDecl *MD = Message->getDecl();
1095 const ObjCInterfaceDecl *StaticClass;
1096 if (isa<ObjCProtocolDecl>(MD->getDeclContext())) {
1097 // We can't find out where the method was declared without doing more work.
1098 // Instead, see if the receiver is statically typed as a known immutable
1100 StaticClass = Message->getOriginExpr()->getReceiverInterface();
1102 StaticClass = MD->getClassInterface();
1108 switch (findKnownClass(StaticClass, /*IncludeSuper=*/false)) {
1112 case FC_NSDictionary:
1113 case FC_NSEnumerator:
1115 case FC_NSOrderedSet:
1121 return Message->getReceiverSVal().getAsSymbol();
1125 ObjCLoopChecker::checkPointerEscape(ProgramStateRef State,
1126 const InvalidatedSymbols &Escaped,
1127 const CallEvent *Call,
1128 PointerEscapeKind Kind) const {
1129 SymbolRef ImmutableReceiver = getMethodReceiverIfKnownImmutable(Call);
1131 // Remove the invalidated symbols form the collection count map.
1132 for (InvalidatedSymbols::const_iterator I = Escaped.begin(),
1137 // Don't invalidate this symbol's count if we know the method being called
1138 // is declared on an immutable class. This isn't completely correct if the
1139 // receiver is also passed as an argument, but in most uses of NSArray,
1140 // NSDictionary, etc. this isn't likely to happen in a dangerous way.
1141 if (Sym == ImmutableReceiver)
1144 // The symbol escaped. Pessimistically, assume that the count could have
1146 State = State->remove<ContainerCountMap>(Sym);
1147 State = State->remove<ContainerNonEmptyMap>(Sym);
1152 void ObjCLoopChecker::checkDeadSymbols(SymbolReaper &SymReaper,
1153 CheckerContext &C) const {
1154 ProgramStateRef State = C.getState();
1156 // Remove the dead symbols from the collection count map.
1157 ContainerCountMapTy Tracked = State->get<ContainerCountMap>();
1158 for (ContainerCountMapTy::iterator I = Tracked.begin(),
1159 E = Tracked.end(); I != E; ++I) {
1160 SymbolRef Sym = I->first;
1161 if (SymReaper.isDead(Sym)) {
1162 State = State->remove<ContainerCountMap>(Sym);
1163 State = State->remove<ContainerNonEmptyMap>(Sym);
1167 C.addTransition(State);
1171 /// \class ObjCNonNilReturnValueChecker
1172 /// \brief The checker restricts the return values of APIs known to
1173 /// never (or almost never) return 'nil'.
1174 class ObjCNonNilReturnValueChecker
1175 : public Checker<check::PostObjCMessage,
1176 check::PostStmt<ObjCArrayLiteral>,
1177 check::PostStmt<ObjCDictionaryLiteral>,
1178 check::PostStmt<ObjCBoxedExpr> > {
1179 mutable bool Initialized;
1180 mutable Selector ObjectAtIndex;
1181 mutable Selector ObjectAtIndexedSubscript;
1182 mutable Selector NullSelector;
1185 ObjCNonNilReturnValueChecker() : Initialized(false) {}
1187 ProgramStateRef assumeExprIsNonNull(const Expr *NonNullExpr,
1188 ProgramStateRef State,
1189 CheckerContext &C) const;
1190 void assumeExprIsNonNull(const Expr *E, CheckerContext &C) const {
1191 C.addTransition(assumeExprIsNonNull(E, C.getState(), C));
1194 void checkPostStmt(const ObjCArrayLiteral *E, CheckerContext &C) const {
1195 assumeExprIsNonNull(E, C);
1197 void checkPostStmt(const ObjCDictionaryLiteral *E, CheckerContext &C) const {
1198 assumeExprIsNonNull(E, C);
1200 void checkPostStmt(const ObjCBoxedExpr *E, CheckerContext &C) const {
1201 assumeExprIsNonNull(E, C);
1204 void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
1209 ObjCNonNilReturnValueChecker::assumeExprIsNonNull(const Expr *NonNullExpr,
1210 ProgramStateRef State,
1211 CheckerContext &C) const {
1212 SVal Val = State->getSVal(NonNullExpr, C.getLocationContext());
1213 if (Optional<DefinedOrUnknownSVal> DV = Val.getAs<DefinedOrUnknownSVal>())
1214 return State->assume(*DV, true);
1218 void ObjCNonNilReturnValueChecker::checkPostObjCMessage(const ObjCMethodCall &M,
1221 ProgramStateRef State = C.getState();
1224 ASTContext &Ctx = C.getASTContext();
1225 ObjectAtIndex = GetUnarySelector("objectAtIndex", Ctx);
1226 ObjectAtIndexedSubscript = GetUnarySelector("objectAtIndexedSubscript", Ctx);
1227 NullSelector = GetNullarySelector("null", Ctx);
1230 // Check the receiver type.
1231 if (const ObjCInterfaceDecl *Interface = M.getReceiverInterface()) {
1233 // Assume that object returned from '[self init]' or '[super init]' is not
1234 // 'nil' if we are processing an inlined function/method.
1236 // A defensive callee will (and should) check if the object returned by
1237 // '[super init]' is 'nil' before doing it's own initialization. However,
1238 // since 'nil' is rarely returned in practice, we should not warn when the
1239 // caller to the defensive constructor uses the object in contexts where
1240 // 'nil' is not accepted.
1241 if (!C.inTopFrame() && M.getDecl() &&
1242 M.getDecl()->getMethodFamily() == OMF_init &&
1243 M.isReceiverSelfOrSuper()) {
1244 State = assumeExprIsNonNull(M.getOriginExpr(), State, C);
1247 FoundationClass Cl = findKnownClass(Interface);
1249 // Objects returned from
1250 // [NSArray|NSOrderedSet]::[ObjectAtIndex|ObjectAtIndexedSubscript]
1252 if (Cl == FC_NSArray || Cl == FC_NSOrderedSet) {
1253 Selector Sel = M.getSelector();
1254 if (Sel == ObjectAtIndex || Sel == ObjectAtIndexedSubscript) {
1255 // Go ahead and assume the value is non-nil.
1256 State = assumeExprIsNonNull(M.getOriginExpr(), State, C);
1260 // Objects returned from [NSNull null] are not nil.
1261 if (Cl == FC_NSNull) {
1262 if (M.getSelector() == NullSelector) {
1263 // Go ahead and assume the value is non-nil.
1264 State = assumeExprIsNonNull(M.getOriginExpr(), State, C);
1268 C.addTransition(State);
1271 //===----------------------------------------------------------------------===//
1272 // Check registration.
1273 //===----------------------------------------------------------------------===//
1275 void ento::registerNilArgChecker(CheckerManager &mgr) {
1276 mgr.registerChecker<NilArgChecker>();
1279 void ento::registerCFNumberCreateChecker(CheckerManager &mgr) {
1280 mgr.registerChecker<CFNumberCreateChecker>();
1283 void ento::registerCFRetainReleaseChecker(CheckerManager &mgr) {
1284 mgr.registerChecker<CFRetainReleaseChecker>();
1287 void ento::registerClassReleaseChecker(CheckerManager &mgr) {
1288 mgr.registerChecker<ClassReleaseChecker>();
1291 void ento::registerVariadicMethodTypeChecker(CheckerManager &mgr) {
1292 mgr.registerChecker<VariadicMethodTypeChecker>();
1295 void ento::registerObjCLoopChecker(CheckerManager &mgr) {
1296 mgr.registerChecker<ObjCLoopChecker>();
1300 ento::registerObjCNonNilReturnValueChecker(CheckerManager &mgr) {
1301 mgr.registerChecker<ObjCNonNilReturnValueChecker>();